Extracted

• • Target

    hjghfggfghfgfhnt.exe

  • Size

    86KB

  • MD5

    e8aab9a49c8f964ccee3d26f5e31cf40

  • SHA1

    bef1609695d579e20f19ddc32f4c05b87e0593be

  • SHA256

    4b99c9ec06743b0551c1f69464d884c9a350dd3efbe4a9e4c2f7f637ee4fd130

  • SHA512

    e165d1ebdfb85635907a84474fc64f3d4f6f9e1953522018de7c1a8876655a3c2e273e526b6f1ec49df337be5971d91870ba47ac574a6ee1fe6241273c3b1dc9

  • SSDEEP

    1536:rt3Jw1XYk6zvWK8m/bgiRBkL+QafT6F4mOduPSVKEl:rt3Jw9G4kbgWk6Qx4mOduPwl

  Score

  10^/10

  xenarmorxwormcollectionpasswordpersistenceratrecoveryspywarestealertrojanupx

  • Detect Xworm Payload

  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

    recoverypasswordxenarmor

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1